EU AI Act Art. 50, 12 & 14 setup snippets, unwrapped-call scan, HMAC receipt & marking hooks.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Optional Bearer spurvik_live_... token for project-linked console calls (not required for the 7 zero-key read-only tools).
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Self-assessment of an AI system under the EU AI Act from a few answers: prohibited (Article 5), high-risk (Annex III), Article 50 transparency only, minimal risk, or outside the EU. Returns the duties with their dates and the Spurvik setup steps. Not legal advice and not a decision under Article 6.
Placed on the market or used in the EU.
Annex III high-risk areas that apply.
Article 5 practices that apply.
Article 50 triggers that apply.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http spurvik-mcp-server https://console.spurvik.com/api/mcp
Headers
Authorization (optional, not in the config above): Optional Bearer spurvik_live_... token for project-linked console calls (not required for the 7 zero-key read-only tools).Self-assessment of an AI system under the EU AI Act from a few answers: prohibited (Article 5), high-risk (Annex III), Article 50 transparency only, minimal risk, or outside the EU. Returns the duties with their dates and the Spurvik setup steps. Not legal advice and not a decision under Article 6.
| Argument | Type | Description |
|---|---|---|
| inEu* | string | Placed on the market or used in the EU. |
| annexIii | array | Annex III high-risk areas that apply. |
| prohibited | array | Article 5 practices that apply. |
| transparency | array | Article 50 triggers that apply. |
{
"type": "object",
"required": [
"inEu"
],
"properties": {
"inEu": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Placed on the market or used in the EU."
},
"annexIii": {
"type": "array",
"items": {
"enum": [
"biometrics",
"remoteBiometricIdentification",
"infrastructure",
"education",
"employment",
"essentialServices",
"lawEnforcement",
"migration",
"justice"
],
"type": "string"
},
"description": "Annex III high-risk areas that apply."
},
"prohibited": {
"type": "array",
"items": {
"enum": [
"subliminal",
"vulnerability",
"socialScoring",
"intimateDeepfake",
"csamGeneration",
"predictivePolicing",
"untargetedScraping",
"emotionWorkplace",
"biometricSensitive",
"realtimeRbi"
],
"type": "string"
},
"description": "Article 5 practices that apply."
},
"transparency": {
"type": "array",
"items": {
"enum": [
"interact",
"synthetic_output",
"emotion_or_biometric",
"deepfake",
"public_interest_text"
],
"type": "string"
},
"description": "Article 50 triggers that apply."
}
}
}Explain the fields of an HMAC provenance receipt JSON. If signingSecret is passed, or SPURVIK_SIGNING_SECRET is set, check the HMAC locally with `verifyProvenanceSignature`, which checks that the record's signed fields still match the HMAC-SHA-256 signature. It does not show that a notice was shown, that output is marked, or that your system meets the Act. The signing secret is not logged. Omit the secret to explain the fields without checking.
| Argument | Type | Description |
|---|---|---|
| receipt* | any | |
| signingSecret | string |
{
"type": "object",
"required": [
"receipt"
],
"properties": {
"receipt": {},
"signingSecret": {
"type": "string"
}
}
}Heuristic static scan of one directory inside the workspace root for AI client calls that are not passed through withSpurvik, spurvikMiddleware, withSpurvikMastra, withSpurvikModel, withSpurvikModelProvider, withSpurvikLangGraph, or spurvikInterrupt. A StateGraph constructor is reported when the file does not call withSpurvikLangGraph. A bare interrupt() call is reported when the file does not call spurvikInterrupt or resolveLangGraphInterrupts. The scan reads .ts, .tsx, .js, .jsx, .mjs, .cjs, .mts, and .cts files. It does not read .md or .mdc files. Results are file:line. The line number is 1-based and counts every newline, including comments and strings. This is a heuristic, so it can miss a call or report one that is already wrapped. The scan does not change files and does not use the network. Paths that leave the workspace, including '..', are rejected. The scanner skips files named .env or .env.* (any case), including through symlinks and hard links. Over HTTP there is no workspace directory. Pass code (a string, max 128 KB) or files (an array of { path, content }). If neither is passed, this tool explains that, and how to run the local stdio MCP server or /spurvik:check for a directory scan.
| Argument | Type | Description |
|---|---|---|
| code | string | |
| files | array |
{
"type": "object",
"properties": {
"code": {
"type": "string"
},
"files": {
"type": "array",
"items": {
"type": "object",
"required": [
"path",
"content"
],
"properties": {
"path": {
"type": "string"
},
"content": {
"type": "string"
}
}
}
}
}
}Generate a copy-paste EU AI Act Article 50 notice: a badge.js <script> tag or a React <AIDisclosureLabel /> snippet, in any of the 24 EU languages, with a preview of the notice text. The language is inferred from a domain-like systemName when locale is omitted.
| Argument | Type | Description |
|---|---|---|
| theme | string | |
| format | string | |
| locale | string | |
| notice | string | |
| placement | string | |
| systemName* | string | Product or assistant name, or the site domain. |
| whitelabel | boolean | Hide the Spurvik trust link (Pro or Done-For-You). |
{
"type": "object",
"required": [
"systemName"
],
"properties": {
"theme": {
"enum": [
"dark",
"light",
"auto"
],
"type": "string"
},
"format": {
"enum": [
"script",
"react"
],
"type": "string"
},
"locale": {
"enum": [
"en",
"da",
"de",
"fr",
"es",
"nl",
"sv",
"pl",
"it",
"pt",
"fi",
"cs",
"bg",
"el",
"et",
"ga",
"hr",
"hu",
"lt",
"lv",
"mt",
"ro",
"sk",
"sl"
],
"type": "string"
},
"notice": {
"enum": [
"interaction",
"generated",
"synthetic_media",
"public_interest_text",
"emotion_biometric"
],
"type": "string"
},
"placement": {
"enum": [
"bottom-right",
"bottom-left",
"inline"
],
"type": "string"
},
"systemName": {
"type": "string",
"description": "Product or assistant name, or the site domain."
},
"whitelabel": {
"type": "boolean",
"description": "Hide the Spurvik trust link (Pro or Done-For-You)."
}
}
}Explain how to plug your own Article 50(2) marking into marking.text or marking.media. Spurvik does not mark content. withSpurvik and spurvikMiddleware log the call and attach an HMAC receipt. A hook runs only when you supply one. The signed text trailer is an application-level binding you can opt into. It is not, by itself, an Article 50(2) machine-readable mark.
| Argument | Type | Description |
|---|---|---|
| surface | string |
{
"type": "object",
"properties": {
"surface": {
"enum": [
"text",
"media",
"both"
],
"type": "string"
}
}
}Scan one public HTTPS page for AI chat widgets and AI SDKs and check whether a visible EU AI Act Article 50(1) notice is present. Returns the host, HTTP status, findings, the suggested notice language, a one-line badge.js fix and links to the full report. Heuristic: reads the HTML of one page only. Not legal advice.
| Argument | Type | Description |
|---|---|---|
| url* | string | Public domain or https URL, for example stepnetwork.dk. |
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Public domain or https URL, for example stepnetwork.dk."
}
}
}Return a setup snippet for openai, anthropic, google-genai, vercel-ai-sdk, mastra, openai-agents, or langgraph. Provider clients are wrapped with withSpurvik. The Vercel AI SDK snippet passes spurvikMiddleware to wrapLanguageModel. The Mastra snippet calls withSpurvikMastra. The OpenAI Agents snippet calls withSpurvikModelProvider. The LangGraph snippet calls withSpurvikLangGraph and spurvikInterrupt. The snippet is built from the installed spurvik exports (`spurvik` or `spurvik-sdk`, including `spurvik/ai`, `spurvik/langgraph`, `spurvik/mastra`, and `spurvik/openai-agents`). The disclosure label is a separate React client snippet that imports `spurvik/react`. `riskTier` is a sample value. Set your own classification (as provider or deployer); Spurvik does not classify your use case. The SDK logs the call and attaches an HMAC receipt. It does not mark content. Also accepts react.
| Argument | Type | Description |
|---|---|---|
| target* | string | |
| runtime | string | |
| framework | string |
{
"type": "object",
"required": [
"target"
],
"properties": {
"target": {
"enum": [
"openai",
"anthropic",
"google-genai",
"vercel-ai-sdk",
"mastra",
"openai-agents",
"react",
"langgraph"
],
"type": "string"
},
"runtime": {
"enum": [
"node",
"next",
"vercel",
"supabase-edge"
],
"type": "string"
},
"framework": {
"enum": [
"openai",
"anthropic",
"google-genai",
"vercel-ai-sdk",
"mastra",
"openai-agents",
"react",
"langgraph"
],
"type": "string"
}
}
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 13, 2026.